A monitoring alert is a signal that needs interpretation. An incident is a managed interruption or degradation with an owner and a path to resolution. Treating every notification as equally urgent creates noise and can obscure the events that matter.
Validate and classify
Check the timestamp, affected service, and whether the condition is still present. Look for an approved maintenance event and correlated failures. A power interruption might create many downstream device alerts that belong to one incident.
Assess impact in business terms: how many users or sites are affected, which operations cannot continue, and whether a working alternative exists. Severity should reflect this impact rather than a vendor's default label alone.
Assign and communicate
- Create or update one incident record.
- Assign an owner and the next action.
- Escalate to the ISP or relevant provider with the evidence needed.
- Give users a known issue summary and any approved workaround.
- Set the next update time, even when the cause remains uncertain.
Preserve useful logs and configuration evidence before disruptive changes. If suspicious activity is involved, follow the separate security response process rather than treating it as an ordinary availability problem.
Close with validation
Confirm that the business task works again, not just that the alert has cleared. Record the cause if established, actions taken, restoration time, and follow-up work. Recurring incidents should lead to a reviewed improvement or a better diagnostic plan, not repeated restarts with no explanation.
Get help with your network
For an existing service issue, open an AvrinTech support ticket. For an assessment or planned improvement, request a scoped proposal and review our networking services. Work, coverage, and response targets depend on your agreement.
